Privacy Policy

Crush Balloon ("we") lets people secretly send a balloon to someone they like. It is run by an individual developer, the developer shown on the App Store. Contact: support@crushballoon.app.

What we collect

• Sign-in data: the account identifier, and the name and email if given, from Apple, Google, LINE or Kakao. We do not collect phone numbers.
• What you enter: your ID and name.
• Member number: an 8-character number we create for each account, so we can find it when you contact us.
• Activity: balloons you send and receive and when, matches, blocks and reports.
• Device data: a push notification token, time zone, language, IP addresses in server logs, and Apple DeviceCheck's mark for this iPhone (only "an account was made on this phone", to stop mass fake accounts; no personal data).
• Region: the country of your App Store account (iPhone) or SIM card (Android), and the country estimated from your IP address and time zone, so we can apply local rules.
• Identity check (only where local law requires it, such as drifting balloons in Korea): the provider's answer on whether you passed and are an adult, and an identifier that can't be turned back into personal data, used to keep it to one account per person. We don't keep your name, ID number or phone number.

On Android, Google Play Integrity checks that the app is the genuine one from Google Play running on a real phone; we only receive whether it passed, no personal data.

Spark leaderboard

Joining the leaderboard is your choice, and you can leave anytime in Settings. While you're on it, if the number of spark balloons you received is in the top 20, everyone can see your name, ID and the count. Leaving removes you right away.

There are no photos, contacts or location in Crush Balloon, and we don't collect them. We don't sell data or use it for ad tracking.

Chat and drifting balloons

When crush balloons match, you talk in the app's own chat. Drifting balloons are opt-in; with your consent we keep your gender and who you'd like to meet (men, women or anyone), used only to decide which balloon yours meets and never shown to anyone. When two balloons meet, an anonymous chat opens; it shows no name or ID. Only when both of you choose to reveal yourselves do you see each other's name and @ID. A chat that isn't revealed closes after 24 hours; a revealed one stays until either of you leaves. So you never meet the same person twice, we keep a record of who you met. Leaving drifting balloons deletes your gender and preference.

Safety records

Once a chat closes or you leave it, its messages no longer appear in the app. To handle reports, prevent scams and harassment, and respond to legal process, we keep a separate encrypted safety record. Only the operator can open it, only to handle a report or an official legal request, and the reason is logged every time:

• Chat messages (text, time, the sender's IP address): 90 days after the chat ends.
• People who were reported or banned: their chats and reports (including the whole conversation), 1 year.
• Sign-ins (time, IP address, sign-in method): 90 days.
• Deleted or banned accounts: member number, @ID, name, sign-in method and creation date, kept as long as the records above so they can still be linked to the account.
• When an ongoing investigation or legal proceeding needs them, the related records are kept until it ends.

After that they are deleted automatically.

Requests from authorities

We give data, limited to what is necessary, only in response to official legal documents from prosecutors, courts or police (such as a warrant, subpoena or court order). We do not hand over data on a phone call or email alone. In an emergency involving a risk to someone's life or safety, we may contact the authorities ourselves.

Why we use it

• To run the service: deliver balloons, detect matches, chat.
• Safety: prevent fake accounts, harassment and abuse; handle reports.
• Notifications: balloons arriving, matches and new messages.

Service providers

• Google Firebase: push notifications.
• Railway: server and database hosting (United States).
• Apple, Google, LINE and Kakao: sign-in. Apple: DeviceCheck. Google: Play Integrity.

They process data only to provide Crush Balloon. We don't share data with anyone else unless the law requires it. Your data is stored on servers in the United States.

How long we keep it

Until you delete your account. Deleting your account immediately removes your account, balloons, matches and chats from the service; the safety records listed above are kept for the periods stated there, then deleted. Server logs are kept for up to 30 days and do not contain email addresses or chat messages.

Your rights

In the app you can view and change your ID and name, or delete your account. For a copy of your data or other requests (access, correction, objection), email us with your member number at support@crushballoon.app; we reply within 30 days. California residents: we do not sell or share personal information.

Age

Crush Balloon is for people 18 and older. Accounts of people under 18 are deleted when found.

Security

Chat messages are stored encrypted with AES-256-GCM, and safety records use a separate key. The only thing we keep of an email address is an HMAC-SHA256 value keyed with a server secret. Keys are stored apart from the database and all traffic uses HTTPS. Chats are not end-to-end encrypted: in the cases above, the operator can decrypt and read them. These values are still personal data (pseudonymized, not anonymous), and we protect them under this policy.

Changes

We'll tell you in the app about important changes.